Splunk Search

Replace entire string if it contains partial string

darls15
Explorer

Can anyone tell me how I would replace entire strings if they contain partial strings. As a basic example, in my search results, if a URL contains the word "homework", I would like to replace the entire URL with just "Homework", if it contains "learn", then "Learning" and so on. I have tried the search below a number of ways and can't seem to get it to work the way I need.

| eval domain = if(cs_host = "*homework*", "homework", if(cs_host = "*learn*", "learning",cs_host))

Domain            Count
Homework         2
Learning             5
etc

Thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@darls15,

Try

|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)

 

Sample result

|makeresults|eval domains="https://homework.mydomain.com https://learn.mydomain.com https://school.mydomain.com"|makemv domains|mvexpand domains
|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)
|stats count by category

alternatively you may use regex to extract the domains if there are multiple domains to be identified.

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@darls15,

Try

|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)

 

Sample result

|makeresults|eval domains="https://homework.mydomain.com https://learn.mydomain.com https://school.mydomain.com"|makemv domains|mvexpand domains
|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)
|stats count by category

alternatively you may use regex to extract the domains if there are multiple domains to be identified.

---
What goes around comes around. If it helps, hit it with Karma 🙂

darls15
Explorer

Thanks renjith_nair, just what I needed!

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...